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REMARKS 

Claims 1-40, 49-59, 61 and 62 are pending in the Application. Claims 1-40, 
49-59, 61 and 62 have been rejected. Claims 1, 17-19, 37, 38, 40, 49, 51, and 52 are 
now amended. 

Claim Rejections - 35 USC 112 

The Examiner rejected claims 37, 38, and 40 under the second paragraph of 35 U.S.C 
1 12, as lacking a sufficient antecedent basis for a limitation. 

Claims 37, 38 and 40 are now amended so to provide an antecedent base to all 
limitations, thus to overcome the 35 U.S.C 112 rejections. 
It is respectfully maintained that claims 37, 38 and 40 are now allowable 

Claim Rejections - 35 USC 102 

The Examiner rejected claims 1-40, 49-59, 61 and 62, under U.S.C. 102(e) as being 
anticipated by Zuk et al (US Patent Publication No. 20030154399 Al), referred herein 
after as f Zuk f . 

Favorable reconsideration of this rejection, in view of the following amendments and 
explanations, is respectfully requested. 

The present application teaches a method and a system that facilitates fast and 
efficient detection and identification of a large number of previously stored 
information and data items, such as words, key-phrases, credit-card numbers, social 
security numbers, names, addresses, email address, account numbers, and other 
strings within electronic traffic. 
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In accordance with preferred embodiments of the present inventions, the prestored 
information items are transformed into a respective canonical representation in 
accordance with a predetermined canonical transformation format, thus facilitating 
much faster and efficient detection and identification of a large number of such 
previously stored information and data items within electronic traffic. The canonical 
representation preserves the original meaning but presents the data in a way that is 
recognizable to the system, and is more robust to changes and manipulations (e.g., 
the same credit-card number can be written with and without dashes, the same word 
can be written in uppercase letters, lowercase letters, with only the first letter 
capitalized, etc.) 

Zuk, as described in the background of the invention section, provides gateway- 
based packet-forwarding network security systems and methods to not only detect 
security breaches on the network but also prevent them by directly dropping 
suspicious packets and connections. These systems and methods employ multiple 
techniques to detect and prevent intrusions, including stateful signature detection, 
traffic signature detection, and protocol anomaly detection. 

Claim 1 as currently amended defines a method for detecting an information item 
within an information sequence obtained from a digital medium, the information 
item comprising any one of a specified set of prestored information items, 
comprising: transforming each of the set of prestored information items into a 
respective canonical representation which is meaning preserving, in accordance with 
a predetermined canonical transformation format; transforming the information 
sequence obtained from the digital medium, in accordance with the transformation 
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format; determining the presence of one or more of the prestored information items 
within the transformed information sequence, utilizing the respective representation. 

As described hereinabove, preferred embodiments of the present invention teach the 
novel and inventive idea of transforming prestored information items into a 
respective canonical representation which is preservative of meaning, in accordance 
with a predetermined canonical transformation format, and determining the presence 
of one or more of the prestored information items within the transformed information 
sequence, utilizing the respective canonical representation. 

For example, the present application describes on page 16, in line 9: "transforming 
the stored information items into a "canonized" form, in which they are represented 
in a lowercase (or uppercase) Unicode representation; omitting all non-alpha- 
numeric characters; transforming the stored information items to their base form, 
whenever possible (e.g., by transforming verbs to "present simple" form, removing 
suffixes such as c "s" and "ly", reducing to phonetic representation etc.); encoding the 
information items into a numeric representation in a manner that facilitates fast 
detection, as explained below". This allows easy and robust recognition and thus 
allows distribution of the data to be controlled. 

Zuk describes extracting signatures from incoming data. However Zuk's signatures 
are not linguistic forms, but rather technical machine level forms, as known in the 
art, and therefore there is no issue of preserving meaning. For example, Zuk 
describes on Paragraph [0093]: "each packet flow descriptor is addressed by a 5- 
tuple key which is unique to that flow and is made of that flow's 5 -tuple <source IP 
address, source port, destination IP address, destination port, protocol>". 
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Zuk never discloses or even hints the novel and inventive idea of transforming 
prestored information items into a respective canonical representation which is 
meaning preserving, in accordance with a predetermined canonical transformation 
format, and determining the presence of one or more of the prestored information 
items within the transformed information sequence, utilizing the respective 
representation, as taught by the present invention and defined by claim 1 . 

It is thus respectfully believed that claim 1 is both novel and inventive over the prior 
art, and is therefore allowable. 

Claim 49 as currently amended defines an apparatus for detecting an information item 
within an information sequence, the information item being any one of a specified set 
of data items, comprising: a preprocessor, for transforming the information item into a 
canonical representation in a way that is preservative of meaning, in accordance with 
a canonical transformation format; and a scanner, for scanning the information 
sequence to identify sub-sequences; and a comparator associated with the 
preprocessor and the scanner, for comparing the canonical representation to the sub- 
sequences to determine the presence of the specified information item within the 
information sequence. 

As described hereinabove, Zuk never discloses or even hints at the novel and 
inventive idea of an apparatus comprising a preprocessor for transforming prestored 
information items into a respective canonical representation having the same 
linguistic meaning as the untransformed item, in accordance with a predetermined 
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canonical transformation format, as taught by the present invention and defined by 
claim 49. 

The remaining claims mentioned in this section of the Office Action are believed to 
be allowable as being dependent on an allowable main claim. 

All of the matters raised by the Examiner have been dealt with and are believed to 
have been overcome. 

In view of the foregoing, it is respectfully submitted that all the claims now pending 
in the application are allowable. 

An early Notice of Allowance is therefore respectfully requested. 



Respectfully submitted, 
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